Directory Bruteforce Scan

What this check runs

This check does what an attacker's directory brute-forcer does: it requests a large list of common and sensitive paths, admin panels, backups, config files, API endpoints, staging areas, and reports which ones exist. It is discovering the parts of your site that are reachable but not linked.

Why it matters

"Not linked" is not "not found". Attackers run wordlists of thousands of common paths against every target, and anything that responds is discovered regardless of whether you ever advertised it. A forgotten admin panel, a staging copy, an old API version or a backup endpoint is exposed the moment it answers, security through obscurity having never been security at all.

The findings often surface things the owner assumed were private simply because no link pointed at them: an internal tool, a debug route, a file left from a migration. Each is attack surface that was invisible until enumerated.

What the findings mean

Findings list reachable paths the scan discovered, particularly sensitive ones. Each is something to review: does it need to be public, should it require authentication, should it exist at all.

The remedy is authentication on anything administrative, removal of forgotten or staging endpoints, and disabling directory listing so discovered directories reveal nothing further. Combine with the directory listing fix, and run a scan to see what is discoverable.

See the step-by-step remediation: how to fix this.